brnch-cli 0.18.1 → 0.18.2

package/README.md

@@ -1,4 +1,4 @@
-# brnch 0.18.1
+# brnch 0.18.2
 
 Command-line client for [Brnch](https://brnch.io) — Git hosting for humans and agents. Single file, no runtime dependencies, Node 20 or newer.
 

package/brnch.mjs

@@ -36901,7 +36901,7 @@ function invalidAgentToolFlag(flag) {
 }
 
 // packages/cli/package.json
-var version2 = "0.18.1";
+var version2 = "0.18.2";
 
 // packages/cli/src/brand.ts
 var BRAND = {
@@ -42184,6 +42184,29 @@ function input2(deps, o) {
   });
 }
 
+// packages/cli/src/step-up.ts
+function needsCliStepUp(e) {
+  const err = isBrnchApiError(e) ? e : e;
+  return err?.code === "MFA_REQUIRED" && err.details?.step_up === "cli";
+}
+function sameOrigin(ctx, start) {
+  try {
+    return new URL(start.verification_uri_complete).origin === new URL(ctx.baseUrl).origin;
+  } catch {
+    return false;
+  }
+}
+async function awaitStepUp(ctx, start) {
+  const deadline = Date.parse(start.expires_at);
+  for (; ; ) {
+    await ctx.deps.sleep(start.interval * 1e3);
+    const s = await ctx.client("user").auth.stepUp.status(start.id);
+    if (s.status === "approved") return s.step_up_expires_at;
+    if (s.status === "denied") throw new CliError("the step-up was denied in the browser", EXIT.UNAUTHENTICATED, "access_denied");
+    if (s.status === "expired" || ctx.deps.sys.now() > deadline + 5e3) throw new CliError(`the code expired before it was approved; run \`${BRAND.cli} auth step-up\` again`, EXIT.UNAUTHENTICATED, "expired_token");
+  }
+}
+
 // packages/cli/src/pending-login.ts
 import { mkdir as mkdir11, readFile as readFile9, rm as rm7, writeFile as writeFile10 } from "node:fs/promises";
 import { dirname as dirname11, join as join18 } from "node:path";
@@ -42455,7 +42478,7 @@ function registerAuth(program2, rt) {
           `This sign-in is for ${agentSignIn.label}, an AI coding agent (detected from ${agentSignIn.source}). The browser asks you to approve an agent sign-in: it can read and start agent sessions you sponsor, and never acts as you. To sign in as yourself, run this in your own terminal (or pass --as-human).`
         );
       }
-      const sameOrigin = (() => {
+      const sameOrigin2 = (() => {
         try {
           return new URL(start.verification_uri_complete).origin === new URL(ctx.baseUrl).origin;
         } catch {
@@ -42466,7 +42489,7 @@ function registerAuth(program2, rt) {
 ${codeBox(start.user_code, paint(true))}
 ` : `! Your one-time code: ${start.user_code}`);
       let opened = false;
-      if (o.browser && ctx.interactive && sameOrigin && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} in your browser`)))
+      if (o.browser && ctx.interactive && sameOrigin2 && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} in your browser`)))
         opened = await ctx.deps.openUrl(start.verification_uri_complete);
       ctx.info(
         opened ? `Opened ${start.verification_uri} in your browser. ${paint(colorEnabled(ctx.deps, "stderr")).dim("Check that it shows the same code, then approve.")}` : `Open ${start.verification_uri_complete}
@@ -42651,18 +42674,11 @@ Store them somewhere safe and offline (a password manager or on paper).`
         }
       }
       const start = await stepUp.start();
-      const sameOrigin = (() => {
-        try {
-          return new URL(start.verification_uri_complete).origin === new URL(ctx.baseUrl).origin;
-        } catch {
-          return false;
-        }
-      })();
       ctx.info(ctx.motion ? `
 ${codeBox(start.user_code, paint(true))}
 ` : `! Your one-time code: ${start.user_code}`);
       let opened = false;
-      if (o.browser && ctx.interactive && sameOrigin && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} and confirm it's you`)))
+      if (o.browser && ctx.interactive && sameOrigin(ctx, start) && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} and confirm it's you`)))
         opened = await ctx.deps.openUrl(start.verification_uri_complete);
       ctx.info(
         opened ? `Opened ${start.verification_uri} in your browser. Check that it shows the same code, then approve and confirm it's you.` : `Open ${start.verification_uri_complete}
@@ -42670,20 +42686,12 @@ ${codeBox(start.user_code, paint(true))}
       );
       if (ctx.motion) ctx.busy(`waiting for you to confirm it's you in the browser \xB7 the code expires in ${minutesLeft(start.expires_at, ctx.deps.sys.now())}`);
       else ctx.info("Waiting for approval\u2026");
-      const deadline = Date.parse(start.expires_at);
-      for (; ; ) {
-        await ctx.deps.sleep(start.interval * 1e3);
-        const s = await stepUp.status(start.id);
-        if (s.status === "approved") {
-          return ctx.result(
-            { status: "approved", step_up_expires_at: s.step_up_expires_at },
-            (v) => `${p.ok("\u2713")} Stepped up until ${v.step_up_expires_at ? `${clockTime(v.step_up_expires_at)}${left(v.step_up_expires_at)}` : "the server's limit"}: administrative actions work from this login until then.
+      const until = await awaitStepUp(ctx, start);
+      return ctx.result(
+        { status: "approved", step_up_expires_at: until },
+        (v) => `${p.ok("\u2713")} Stepped up until ${v.step_up_expires_at ? `${clockTime(v.step_up_expires_at)}${left(v.step_up_expires_at)}` : "the server's limit"}: administrative actions work from this login until then.
   ${p.dim(`End it sooner: ${BRAND.cli} auth step-up --end`)}`
-          );
-        }
-        if (s.status === "denied") throw new CliError("the step-up was denied in the browser", EXIT.UNAUTHENTICATED, "access_denied");
-        if (s.status === "expired" || Date.now() > deadline + 5e3) throw new CliError(`the code expired before it was approved; run \`${BRAND.cli} auth step-up\` again`, EXIT.UNAUTHENTICATED, "expired_token");
-      }
+      );
     })
   );
   auth.command("git-credential").description("git credential helper: answers `get` for the configured server with your token (store/erase are no-ops)").argument("<operation>", "get | store | erase (invoked by git)").action(
@@ -44376,6 +44384,41 @@ var Quickstart = class {
     const g2 = this.ctx.globals;
     return [...g2.url ? ["--url", g2.url] : [], ...g2.token ? ["--token", g2.token] : [], ...g2.account ? ["--account", g2.account] : [], ...g2.asHuman ? ["--as-human"] : [], ...g2.agentTool ? ["--agent-tool", g2.agentTool] : []];
   }
+  /** Whether this run already asked the person to step up (once: a second refusal is the answer). */
+  steppedUp = false;
+  /**
+   * `run`, and again after the person confirms it's them in the browser when the organization requires a second factor
+   * for it (ADR-0062): quickstart runs long enough that a step-up approved before it may have lapsed by the deploy.
+   * `refusal` finds the error in a composed command's `--json` output.
+   */
+  async withStepUp(row, run3, refusal = () => null) {
+    try {
+      const v = await run3();
+      if (!needsCliStepUp(refusal(v)) || !await this.stepUp(row)) return v;
+    } catch (e) {
+      if (!needsCliStepUp(e) || !await this.stepUp(row)) throw e;
+    }
+    return run3();
+  }
+  async stepUp(row) {
+    const { ctx } = this;
+    if (!ctx.interactive || this.steppedUp) return false;
+    this.steppedUp = true;
+    const start = await ctx.client("user").auth.stepUp.start();
+    const opened = sameOrigin(ctx, start) && await ctx.deps.openUrl(start.verification_uri_complete);
+    const todo = `Your organization asks for a second factor here: confirm it's you ${opened ? "in the page that just opened" : `at ${start.verification_uri_complete}`} (code ${start.user_code})`;
+    if (this.board) {
+      this.running(row, "waiting for you to confirm it's you in the browser");
+      this.board.hint(`${todo} ${this.errPaint.dim("(Ctrl-C stops; the repository is ready either way)")}`);
+    } else ctx.info(`  ${todo}. Waiting for it\u2026`);
+    try {
+      await awaitStepUp(ctx, start);
+    } finally {
+      this.board?.hint(null);
+    }
+    this.note(row, "confirmed: continuing");
+    return true;
+  }
   /** A composed command, in `cwd`, as JSON. Under the board it runs quietly (its stderr and git's are returned instead). */
   async runJson(argv, cwd) {
     this.ctx.idle();
@@ -44625,7 +44668,7 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
   const later = `connect Cloudflare at ${integrationsUrl(ctx, ns)}, then \`${BRAND.cli} --repo ${spec} deploy setup\` and \`${BRAND.cli} --repo ${spec} deploy run production --wait\``;
   q.running("deploy", "looking for a Cloudflare connection");
   const repo = await ctx.repoId(spec, "user");
-  const usable = async () => (await ctx.client("user").deploy.connections(repo)).items.some((c8) => c8.state === "active");
+  const usable = () => q.withStepUp("deploy", async () => (await ctx.client("user").deploy.connections(repo)).items.some((c8) => c8.state === "active"));
   if (!await usable()) {
     if (!ctx.interactive) {
       q.record("deploy", "planned", later, `connect Cloudflare, then \`${BRAND.cli} deploy setup\``);
@@ -44652,7 +44695,11 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
   }
   q.running("deploy", "creating the deploy target");
   const pinned = home2.cloudflare ? ["--connection", home2.cloudflare.connection, "--account-id", home2.cloudflare.account] : [];
-  const setup = await q.runJson(["--repo", spec, "deploy", "setup", ...pinned], dir);
+  const setup = await q.withStepUp(
+    "deploy",
+    () => q.runJson(["--repo", spec, "deploy", "setup", ...pinned], dir),
+    (r) => r.value?.error
+  );
   if (setup.code === EXIT.USAGE) {
     q.record("deploy", "planned", `choose what deploys it, then \`${BRAND.cli} --repo ${spec} deploy setup --connection <icn_\u2026> [--account-id <id>]\` and \`${BRAND.cli} --repo ${spec} deploy run production --wait\`${setup.reason}`, `choose a Cloudflare connection: \`${BRAND.cli} deploy setup --connection \u2026\``);
     return;
@@ -44662,7 +44709,8 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
     return;
   }
   const deploy = ctx.client("user").deploy;
-  let d = await deploy.targets.deploy(setup.value.id, {});
+  const target = setup.value.id;
+  let d = await q.withStepUp("deploy", () => deploy.targets.deploy(target, {}));
   const deadline = ctx.deps.sys.now() + o.deployTimeout * 1e3;
   let last = "";
   for (; ; ) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brnch-cli",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Brnch CLI: Git hosting for humans and agents, from the command line",
   "keywords": [
     "git",
@@ -16,7 +16,8 @@
   "license": "UNLICENSED",
   "type": "module",
   "bin": {
-    "brnch": "brnch.mjs"
+    "brnch": "brnch.mjs",
+    "docker-credential-brnch": "brnch.mjs"
   },
   "files": [
     "brnch.mjs",